CVE-2018-1999023

CVE-2018-1999023 affects The Battle for Wesnoth Project versions 1.7.0 through 1.14.3. The vulnerability is a Code Injection flaw in the Lua scripting engine that can lead to code execution outside the sandbox. Exploitation vectors include loading specially-crafted saved games, networked games, r...

CVE-2018-1999023

Removed by vendor...

CVE-2018-1999023: Improper Control of Generation of Code

The Battle for Wesnoth Project version 1.7.0 through 1.14.3 contains a Code Injection vulnerability in the Lua scripting engine that can result in code execution outside the sandbox. This attack appear to be exploitable via Loading specially-crafted saved games, networked games, replays, and play...

PT-2018-15202

Name of the Vulnerable Software and Affected Versions The Battle for Wesnoth Project versions 1.7.0 through 1.14.3 Description The issue concerns a Code Injection vulnerability in the Lua scripting engine, which can lead to code execution outside the sandbox. This can be exploited by loading...

wesnoth -- Code Injection vulnerability

shadowm reports: A severe bug was found in the game client which could allow a malicious user to execute arbitrary code through the Lua engine by using specially-crafted code in add-ons, saves, replays, or networked games. This issue affects all platforms and all existing releases since Wesnoth...

Design/Logic Flaw

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...

CVE-2015-5069

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML...

CVE-2015-5070

Removed by vendor...

CVE-2015-5069

CVE-2015-5069 pertains to the Battle for Wesnoth game. The vulnerability affects versions prior to 1.12.3 and 1.13.x prior to 1.13.1, where two functions (filesystem::get_wml_location in filesystem.cpp and is_legal_file in filesystem_boost.cpp) could allow remote attackers to exfiltrate sensitive...

CVE-2015-5070

The CVE-2015-5070 entry concerns Battle for Wesnoth prior to 1.12.4 and 1.13.x before 1.13.1, where the functions filesystem::get_wml_location (filesystem.cpp) and is_legal_file (filesystem_boost.cpp) on case-insensitive filesystems could disclose sensitive information via vectors related to .pbl...

CVE-2015-5069

Removed by vendor...

CVE-2015-5069

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML...

CVE-2015-5070

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...

CVE-2015-5069: Exposure of Sensitive Information to an Unauthorized Actor

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.3 and 1.13.x before 1.13.1 allow remote attackers to obtain sensitive information via vectors related to inclusion of .pbl files from WML...

CVE-2015-5070: Exposure of Sensitive Information to an Unauthorized Actor

The 1 filesystem::getwmllocation function in filesystem.cpp and 2 islegalfile function in filesystemboost.cpp in Battle for Wesnoth before 1.12.4 and 1.13.x before 1.13.1, when a case-insensitive filesystem is used, allow remote attackers to obtain sensitive information via vectors related to...

Battle for Wesnoth LEGACY - Dangerous filesystem permissions, External URLs, Native code usage vulnerabilities

HackApp vulnerability scanner discovered that application Battle for Wesnoth LEGACY published at the 'play' market has multiple vulnerabilities...

Mageia: Security Advisory (MGASA-2015-0283)

The remote host is missing an update for the SPDX-FileCopyrightText: 2015 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

Debian DLA-297-1 : wesnoth-1.8 security update

Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use of the same function filesystem::getwmllocation to resolve file paths so that only...

[SECURITY] [DLA 297-1] wesnoth-1.8 security update

Package : wesnoth-1.8 Version : 1:1.8.5-1+deb6u2 CVE ID : CVE-2015-5069 CVE-2015-5070 Wesnoth implements a text preprocessing language that is used in conjunction with its own game scripting language. It also has a built-in Lua interpreter and API. Both the Lua API and the preprocessor make use o...